Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

HSRP on public interface

All,

Is it possible to put an HSRP configuration on 2 routers that face the internet? Would I eat 3 public addresses doing it?

router 1: 5.5.5.2

router 2: 5.5.5.3

standby: 5.5.5.1

Is this possible?

Thanks,

John

HTH, John *** Please rate all useful posts ***
1 ACCEPTED SOLUTION

Accepted Solutions
Hall of Fame Super Silver

Re: HSRP on public interface

John

Assuming that router1 and router2 are connected on a common subnet, which is the Internet facing interfaces, then yes this is possible. And yes it would consume 3 public addresses.

A somewhat different question from "can I do this" is the question of "why would I want to do this". Since HSRP generally is to solve the problem of redundant gateways on the local subnet, what problem is it solving to put it on the Internet facing interfaces?

HTH

Rick

6 REPLIES
Hall of Fame Super Silver

Re: HSRP on public interface

John

Assuming that router1 and router2 are connected on a common subnet, which is the Internet facing interfaces, then yes this is possible. And yes it would consume 3 public addresses.

A somewhat different question from "can I do this" is the question of "why would I want to do this". Since HSRP generally is to solve the problem of redundant gateways on the local subnet, what problem is it solving to put it on the Internet facing interfaces?

HTH

Rick

Re: HSRP on public interface

Well, no problem. I'm studying for a test and one of the practice questions was how to provide redundancy on an internet link for VPN users without having to reconfigure their client. The answer was HSRP, and that's the only way I could figure it would be the case. Each one of the clients would configure their software to connect to the standby IP, and in case that dies, the other will still be valid. So, there could be other reasons (aside from GLBP), like host a webserver for instance. I could see doing it for that also.

Thanks Rick!

John

HTH, John *** Please rate all useful posts ***
Hall of Fame Super Silver

Re: HSRP on public interface

Hello John,

we use this setup to perform Stateful IPSec failover:

we have two 7206VXR with NPE GE2 and they share the IPSec SA using a TCP connection between them.

the ip address used to terminate the IPSec is actually the HSRP VIP on the public lan interface.

Hope to help

Giuseppe

Silver

Re: HSRP on public interface

How does Stateful failover IPSec work for you?

During three months of testing last year, I

found that Stateful IPsec failover on Cisco

IOS is not stable.

What version IOS do you use?

Hall of Fame Super Silver

Re: HSRP on public interface

Hello David,

we actually had problems of sudden and random connections drops at first.

We opened a Service Request.

they suggested us to keep the configuration equal (you need to do it manually it is not like in PIX).

at the end at the second IOS upgrade, packet capture and two mounths it is working better

We currently use

c7200p-advsecurityk9-mz.124-20.T.bin

before in 12.4(19)T the first ios suggested for upgrade we couldn't reach the hot standby redundancy state.

However, the feature has some strange behaviour like it triggers a reload when a change of state master to slave happens !

This happens also if you shut one interace either public or private or if you try to remove redundancy configuration. (at least in 12.4(19)T)

states are ruled by HSRP group priorities and we configured higher priorities on both public and private interfaces on the same router with tracking.

This is different from what suggested in the feature where they suggest to use same priorities on both routers: this can cause unnecessary changes of state.

RT-RM-TLD066-NEW-VPN-2 uptime is 19 weeks, 1 day, 20 hours, 35 minutes

System returned to ROM by reload at 00:11:25 MEST Wed Sep 10 2008

System restarted at 00:12:40 MEST Wed Sep 10 2008

System image file is "disk2:c7200p-advsecurityk9-mz.124-20.T.bin"

RT-RM-TLD066-NEW-VPN-2#sh red stat

my state = 13 -ACTIVE

>>> peer state = 8 -STANDBY HOT

Mode = Duplex

Unit ID = 0

Maintenance Mode = Disabled

Manual Swact = Enabled

Communications = Up

client count = 9

client_notification_TMR = 30000 milliseconds

RF debug mask = 0x0

RT-RM-TLD066-NEW-VPN-2

Hope to help

Giuseppe

New Member

Re: HSRP on public interface

Hope this link can help you. Im about to test it now with two 2851

http://www.cisco.com/en/US/docs/ios/12_4t/12_4t11/ht_sfo.html

282
Views
0
Helpful
6
Replies